0

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the password manager also visible? Or is that out of the scope for this attack?

  • 1
    Do you understand how CSRF attacks work? "the ability to access credentials" is a little misleading. – AndrolGenhald Jan 10 at 18:29
  • @AndrolGenhald Not entirely, I was reading through OWASP when the question popped in, still trying to get a handle on it! I apologize for the misleading tile. – HoleyCow Jan 11 at 0:00
  • It's not the title that's misleading, it's your description of CSRF. CSRF doesn't so much "access" credentials (meaning session cookies) as "hijack" them. The important distinction is that the attacker never knows the value of the cookie, he is only able to use it through the victim's browser. – AndrolGenhald Jan 11 at 0:30
  • @AndrolGenhald so to check my understanding, when the attacker is executing a CSRF they only know the "containers" (for lack of a better term) and not necessarily what is in them. – HoleyCow Jan 11 at 0:48
2

The term "CSRF" is very broad and, in my opinion, your definition of CSRF is not entirely accurate. A CSRF vulnerability's abilities depend on what endpoint is actually vulnerable to CSRF. Being able to send a request on behalf of a user that changes their profile picture, for example, wouldn't fall under your definition of CSRF above. If you have discovered a CSRF vulnerability on example.com, for instance, this does not necessarily affect your password manager per se. A far more significant attack in the context of password managers, is stored XSS or a subdomain takeover whereby an adversary can trick the victim's password manager into auto-filling a sign-in form, because the password manager trusts the origin.

enter image description here

(Source: https://twitter.com/albinowax/status/1011623832766111744)

It sounds to me like this is probably what you had in mind but were associating this attack vector with CSRF. On the other hand, a CSRF vulnerability in your password manager might be something to be concerned about, but that is a vulnerability in the password manager itself and not the page the user is currently visiting.

  • Thank you, definitely clarified some confusion I had! – HoleyCow Jan 10 at 23:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.